An interesting question is which frequencies are affected by an adversarial effect. Therefore we look at the different frequencies for the BIM and Deepfool attacks on CIFAR-10. As shown in Table REF  and Table REF  we observe for both methods that by only looking at the lowest or highest 25% frequencies the performance is low. On the other hand, considering only one of the mid-frequency bands we already achieve a very good result. This confirms the observation that adversarial attacks are not a high-frequency issue [1]}, but rather a mid-frequency issue.
<TABLE><TABLE>